Gohighlevel Get Integration Token: How to Get It?

Connecting HighLevel to another app needs the right API credentials. Many old guides still show the outdated API key steps. You may not find those settings in your account today. You may also create a token without the permissions your app needs.

The current method uses a Private Integration Token, often called a PIT. This guide shows you how to get a GoHighLevel integration token. You will also learn how to pick scopes, use the token, and fix errors.

Book Free Consultation Call

Claim Free Funnels + $10K Bonuses!

Quick Answer: You can get a GoHighLevel integration token by creating a Private Integration in the right HighLevel Agency or Sub Account. Select the required API scopes, then generate the token. Use it as a Bearer token for authorized API requests.

What Is a GoHighLevel Private Integration Token?

A GoHighLevel Private Integration Token is a secure key for the HighLevel API. It is also called a PIT. Your app sends it with every request. HighLevel then knows the request is allowed.

Think of it this way:

The token shows who is calling the API.
The scopes decide what that caller can do.

What a PIT Is Used For

Teams use HighLevel API credentials for many daily tasks.

Send HighLevel data to your own software.
Run HTTP requests inside tools such as Make, n8n, and Zapier.
Connect AI agents and the HighLevel MCP server.
Build custom scripts that read or update HighLevel CRM contacts.

PIT vs API Key

The old API key gave broad access to one HighLevel Location. It worked with API v1. A Private Integration Token works with API v2. It limits access by scope.

This is safer for most teams. You give the integration only the permissions it needs. You can also edit those scopes later. You do not need to create a new token for that change.

Read this: How to Build a High-Converting GoHighLevel Franchise Workflow Setup for Multi-Location Brands

How to Get a GoHighLevel Integration Token

The steps are simple. Follow them in order. Small mistakes here cause most token problems later.

Step 1: Log In to HighLevel

Open your HighLevel account and sign in. Use a user role that can change settings. A user with limited access may not see the Private Integrations page.

Step 2: Open the Correct Agency or Sub Account

This step matters more than people think. A token only works inside the level where you create it.

Use a Sub Account for one business or one HighLevel Location.
Use the Agency level only when you need agency scopes.
Agency scopes include actions such as managing Locations.

Most users need a Sub Account token. Pick the Sub Account that holds the data you want to reach.

Step 3: Go to Private Integrations

Open Settings from the left menu. Then choose Private Integrations. Some accounts do not show this page at first. If you cannot see it, open the Labs section in Settings. Turn Private Integrations on there.

Menu names can change after HighLevel updates. If the page looks different, use the search bar in Settings.

Step 4: Create a New Integration

Click Create New Integration. Give it a clear name. The name will appear in your API logs. A name like “Make Lead Sync” is better than “Test.”

Add a short description if the form asks for one. This helps your team later. Many agencies run ten or more integrations across clients.

Step 5: Select the Required Scopes

Scopes are the permissions for your token. Pick only the scopes your app needs. The next section explains how to choose them.

Step 6: Generate and Copy the Token

Click Create. Confirm if HighLevel asks you to. The token appears on screen. Copy it right away. HighLevel shows the full token only one time. You cannot view it again later.

Step 7: Store the Token Securely

Paste the token into a password manager. You can also use a secure environment variable. Do not paste it into public docs or chat threads. Do not place it in code that goes to a public repository.

What Permissions Should You Give a HighLevel Integration Token?

HighLevel API permissions are called scopes. Each scope opens one area of your account. The names usually end with readonly or write.

Read Permissions

Read scopes let an app view data. They cannot change anything.

The contacts.readonly scope lets an app view contacts.
The opportunities.readonly scope lets an app view pipeline deals.
The calendars.readonly scope lets an app view calendars.
The locations.readonly scope lets an app view Location details.

Write Permissions

Write scopes let an app create or change data.

The contacts.write scope lets an app create or update contacts.
The opportunities.write scope lets an app create or update deals.
Conversation and message scopes let an app send or manage messages.

Choose Only Required Scopes

Start with the smallest set that works. Here are simple starting points.

For a contact sync, use contacts.readonly and contacts.write.
For reporting only, use read scopes for each area you track.
For a full CRM tool, add opportunities and calendars as needed.

Always check the API page for each endpoint you plan to call. HighLevel lists the exact scope that endpoint needs.

Why Minimum Permissions Matter

Every extra scope adds risk. A leaked token with broad access can expose client data. A token with narrow scopes limits the damage. Minimum permissions also make audits easier. You can see at a glance what each integration can do.

How to Use a GoHighLevel Integration Token

You use the token for GoHighLevel API authentication. Your app sends it in the request header. The method is called Bearer token authentication.

Add the Token as a Bearer Token

Every request needs an Authorization header. The value starts with the word Bearer. Then add a space and your token.

Most v2 requests also need a Version header. The current value is 2021-07-28. Check the HighLevel API docs if the value changes.

Basic API Request Example

This example reads details for one HighLevel Location. It needs the locations.readonly scope.

curl “https://services.leadconnectorhq.com/locations/YOUR_LOCATION_ID” \

-H “Authorization: Bearer YOUR_PIT_TOKEN” \

-H “Version: 2021-07-28” \

-H “Accept: application/json”

Replace the two placeholder values with your own details. A valid reply returns data in JSON format. An error reply tells you what went wrong.

Use the Correct Location ID

Many endpoints need a HighLevel Location ID. This ID points to one Sub Account. You can find it in Settings under Business Profile. You can also see it in the page address when you work inside that Sub Account.

The token and the Location ID must match. A token from one Sub Account cannot read another Sub Account.

Use the Token in No Code Tools

Many tools have an HTTP or webhook module. Add the same Authorization and Version headers there. Then test with a simple read request first.

GoHighLevel Private Integration Token vs OAuth

HighLevel has two main ways to authorize API v2 calls. Each one fits a different job.

Private Integration Token

A PIT is a static token. It stays valid until you rotate or delete it. You create it inside your own account. It is quick to set up.

Ideal for: Internal tools, scripts, and automations for your own accounts.

OAuth 2.0

OAuth is used for apps in the HighLevel Marketplace. Other HighLevel users install your app. Each install gives your app its own access token. These tokens are short-lived. Your app renews them with a refresh token.

Ideal for: Public apps that many HighLevel accounts will install.

When to Use Each

Use a PIT when you control the account. Use OAuth when you build for other people. If you serve many clients as an agency, a PIT per Sub Account works well. Keep each token scoped to that client.

How to Rotate or Revoke a GoHighLevel API Token

Tokens should not live forever. Plan to rotate them on a regular schedule. Many teams choose every 90 days. Rotate right away if a token is ever exposed.

Rotate a Token

Open Settings and go to Private Integrations. Select the integration you want to change. HighLevel gives you two rotation choices.

Rotate and expire this token now. The old token stops working at once.
Rotate and expire this token later. The old token keeps working for 7 days.

The second choice is safer for live systems. It gives you time to update your apps.

Revoke a Compromised Token

If a token leaks, use the option to expire it now. This blocks the old token immediately. You can also delete the integration. Deleting removes access fully.

Update Connected Applications

After rotation, paste the new token into each connected app. Update scripts, automation tools, and server settings. Then run a test request. Confirm that data still flows as expected.

Common GoHighLevel Integration Token Errors

Most token errors have simple causes. Check the basics first. Then move to the details below.

Invalid or Expired Token

An invalid GoHighLevel API token often has a copy error. A space or missing character can break it. Paste the token again and check both ends. If you deleted or rotated the token, create or copy a new one.

401 Unauthorized

A 401 error means HighLevel could not confirm your token. Check these items.

The Authorization header starts with the word Bearer.
The token has no extra spaces or line breaks.
The token has not been rotated or deleted.

403 Forbidden

A 403 error means the token is valid but lacks permission. The most common cause is a missing scope. Open the integration and add the scope. Save the change. You do not need a new token.

Missing API Scope

Each endpoint lists its required scope. Compare that list with your integration. A read scope cannot create a contact. You need the matching write scope for that.

Incorrect Location ID

A wrong Location ID can return access errors or empty results. Copy the ID again from Business Profile. Make sure it belongs to the same Sub Account as the token.

Wrong Agency or Sub Account Access

An agency token and a Sub Account token are not the same. A Sub Account token cannot call agency level actions. An agency token may need extra steps to reach one Location. Create the token at the level that matches your task.

Need help fixing an integration? Our team can review your setup. Book a free call and we will find the cause.

Are GoHighLevel API Keys Still Supported?

You should not build anything new on them. HighLevel treats API v1 and its keys as legacy. New features arrive in API v2. HighLevel has also told users to move away from v1.

API v1 Status

API v1 is the older version of the HighLevel API. It used a location-level key. It does not get the newer endpoints and scope controls. Support for it may end, so plan your move now.

Legacy API Keys

Older accounts may still show an API key under Business Profile. Existing tools may still use it. Treat these keys as temporary. Do not share them. Rotate them if you think they leaked.

Moving From API Keys to Private Integration Tokens

The move is not hard. Follow this plan.

List every tool that uses your old API key.
Create a Private Integration with the scopes each tool needs.
Switch each tool to the new token and the v2 endpoints.
Test each tool with a simple request.
Remove the old key when all tools work.

Some v1 endpoints have new names or formats in v2. Test carefully before you switch a live system.

Frequently Asked Questions

How do I get a GoHighLevel integration token?

Log in to HighLevel and open the right Sub Account. Go to Settings and open Private Integrations. Click Create New Integration. Select your scopes and create it. Then copy the token right away.

Where do I find my HighLevel API token?

You find it only when you create it. Open Settings and Private Integrations to manage your integrations. HighLevel does not show the full token again. If you lost it, rotate the token and copy the new one.

What is a Private Integration Token?

It is a scoped access token for the HighLevel API v2. It is made for private use inside your own accounts. It works similarly to an API key. It is safer because you limit its permissions.

Can I use a PIT instead of OAuth?

Yes, for private use in your own accounts. A PIT is faster to set up. Use OAuth if you build a public Marketplace app. Other HighLevel accounts will install that app.

Why is my GoHighLevel API token not working?

The cause is usually small. Check the Bearer format and the Version header. Confirm the token matches the right Sub Account. Check that the integration has the required scopes. Make sure nobody rotated or deleted the token.

Final Thoughts

The current method is a Private Integration Token. It is faster than the old API key flow. It gives you better control over access.

Create the token at the right level. Choose only the scopes you need. Store the token safely. Rotate it on a schedule. Use OAuth when you build a public app for other users.

Schedule a FREE 30-minute consultation and let our team set up your HighLevel integration.